feat: reconcile granted ops run closes

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06bfe-2a55-7ed3-bacd-879977b099bf
This commit is contained in:
tegwick 2026-09-04 12:57:12 +02:00
parent b72fdb5452
commit b63131e863
21 changed files with 1240 additions and 43 deletions

View file

@ -145,6 +145,42 @@ def test_definition_parse_rejects_a_malformed_profile(tmp_path) -> None:
parse_file(tmp_path / "profiled.md")
def test_definition_parse_validates_and_preserves_repository_grant(tmp_path) -> None:
_write_profiled_definition(
tmp_path,
""" repository_grant:
version: "1"
allowed_paths: [docs/, README.md]
commit_count: {min: 1, max: 1}
publish: false
""",
)
definition = parse_file(tmp_path / "profiled.md")
assert definition.rules[0]["action"]["repository_grant"] == {
"version": "1",
"allowed_paths": ["docs/", "README.md"],
"commit_count": {"min": 1, "max": 1},
"publish": False,
}
def test_definition_parse_rejects_unsafe_repository_grant(tmp_path) -> None:
_write_profiled_definition(
tmp_path,
""" repository_grant:
version: "1"
allowed_paths: [../escape]
commit_count: {min: 1, max: 1}
publish: false
""",
)
with pytest.raises(ParseError, match="invalid repository_grant"):
parse_file(tmp_path / "profiled.md")
def test_definition_parse_requires_rule_profile_in_strict_mode(
tmp_path,
monkeypatch,